hashicorp / hashicorp/vault-helm

Four securityContext parameters are not generated (runAsNonRoot, runAsGroup, runAsUser, fsGroup)

Open
#343 5 comments 0 reactions 0 assignees View on GitHub
openshift question
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

[vault-all.yaml.zip](https://github.com/hashicorp/vault-helm/files/4845273/vault-all.yaml.zip)

Helm Chart: 0.6.0
Helm Command (works as expected): `helm template vault vault-0.6.0.tgz > vault-all-new.yaml`
This results in the StatefulSet with the following:
```
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 100
fsGroup: 1000
```

When run with this command all four parameters are omitted from the StatefulSet (runAsNonRoot, runAsGroup, runAsUser, fsGroup).
Helm command (does not generate the securityContext parameters):
```
helm template vault hashicorp/vault --namespace "xyz"
--values "values-minimal.yaml"
--set='server.image.repository=hashicorp/vault-enterprise'
--set='server.image.tag=1.4.2_ent'
--set='server.ha.enabled=true'
--set='server.ha.raft.enabled=true'
--set='server.route.enabled=true'
--set='server.extraEnvironmentVars.VAULT_CACERT=/vault/userconfig/vault-tls/vault.ca'
--set='server.tls.secretName=vault-tls'
--set='global.tlsDisable=false'
--set='global.openshift=true'
> "/home/user/vault-all.yaml"
```
This is the content of **values-minimal.yaml** supplying parameters to the above helm template command:
```
server:
ha:
raft:
config: |
ui = true

listener "tcp" {
tls_disable = 0
tls_cert_file = "/vault/userconfig/vault-tls/vault.crt"
tls_key_file = "/vault/userconfig/vault-tls/vault.key"
address = "[::]:8200"
cluster_address = "[::]:8201"
}

storage "raft" {
path = "/vault/data"
}

service_registration "kubernetes" {}
```
Please find attached the resulting **vault-all.yaml** file.

Contributor guide

Open the contributing guide

Research direction

Reproduce the difference between the two helm template commands using values-minimal.yaml, then compare the generated vault-all.yaml with the attached expected output. Trace the chart template that renders the StatefulSet securityContext; done means runAsNonRoot, runAsGroup, runAsUser, and fsGroup are generated for the reported configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.